Mobile Forensics Cookbook

Chapter 1. SIM Card Acquisition and Analysis

In this chapter, we'll cover the following recipes:

SIM card acquisition and analysis with TULP2G
SIM card acquisition and analysis with MOBILedit Forensics
SIM card acquisition and analysis with SIMCon
SIM card acquisition and analysis with Oxygen Forensic

Introduction

The main function of a SIM card is the identification of a user of a cellular phone on the network so that they can get access to its services.

The following types of data, which are valuable for an expert or investigator, can be found in the SIM card:

Information related to the services provided by the mobile operator
Phonebook and information about calls
Information about messages exchanged
Location information

Initially, SIM cards were almost the only source of data about the contacts of the mobile device owner, as the information about the phonebook, calls, and messages could be found only in their memory. Later, the storage of these data was relocated to the mobile devices memory and SIM cards began to be used only to identify subscribers in cellular networks. This is why some of the forensic tools developers, for the examination of mobile devices, decided not to include the SIM cards examination function in their products. However, today there are a lot of cheap phones (often, we call them "Chinese phones") with limited memory capacity. In these phones, part of the phone owners' data is stored in the SIM cards. This is why the forensic examination of SIM cards remains relevant.

SIM card is a regular smart card. It contains the following main components:

Processor
RAM
ROM
EEPROM
A file system
Controller I/O

In practice, we come across two kinds of SIM cards with six and eight contacts on the contact pads. This happens because the two contacts do not directly interact with the phone (smartphone) and their absence decreases the size of the area occupied by a SIM card when it is placed in the mobile device.

SIM cards can use three types of supply voltage (VCC): 5 V, 3.3 V, 1.8 V. Each card has a particular supply voltage.

There is an overvoltage protection in SIM cards. This is why when a 3.3 V supply voltage SIM card is placed in the card reader, that can operate only with 5 V supply voltage (old models), neither the information nor the SIM card can be damaged, and it will be impossible to work with this SIM card. As such, an expert may think that the SIM card is faulty. However, it is not so.

The forensic examination of a SIM card, before data extraction from the mobile device, where it is installed, is unreasonable. As the user's data stored in the memory of the mobile device, it can be reset or deleted during the process of removing the SIM card.

For analysis, a SIM card has to be removed from the mobile device and connected to the expert's computer via a specific device: a card reader.

Based on the previously mentioned information about SIM cards, we can figure out the main requirements to a card reader device with which it will be comfortable for an expert to examine SIM cards:

The card reader device has to support smart cards with supply voltage of 5 V, 3.3 V, and 1.8 V.
The card reader device has to support smart cards with six and eight contacts on the contact pads.
The card reader device has to support Microsoft PC/SC protocol. Drivers for this kind of devices are pre-installed on all versions of the Windows operating systems. This is why there is no need to install additional drivers in order to connect such devices to the expert's computer.

The following image shows an example of such a card reader:

SIM cards reader produced by «ASR» company, model «ACR38T».

Despite the fact that there are card reader devices designed for reading data from SIM cards, card reader devices designed for reading data from the standard size cards (having the size of a bank card) can be used. To work comfortably with these devices, a blank card, to which the SIM card is adjusted with some small pieces of tape, is used.

This is a SIM card adjusted with a bank card looks.

SIM card acquisition and analysis with TULP2G

TULP2G is a free tool developed by Netherlands Forensic Institute for forensic examination of SIM cards and cellular phones. Unfortunately, this program has not been updated for a long time. However, it can be used for very old cellular phones and SIM cards data acquisition and analysis.

Getting ready

On the TULP2G download page (https://sourceforge.net/projects/tulp2g/files/), select the TULP2G-installer-1.4.0.4.msi file and download it. At the time of writing this, the most up-to-date version is 1.4.0.4. When the download is finished, double-click on this file. The installation process of the program will be started.

Note

If the installation of the TULP2G program is performed in the Windows XP operating system, you need to install Microsoft Net Framework 2.0 and Windows Installer 3.1 before the installation of the TULP2G. The programs mentioned previously can be downloaded from the Microsoft Corporation website.

How to do it...

When the program is launched, click on the Open Profile... button:

The main window of the TULP2G program

In the opened window, you will find profiles, one of which has to be loaded in the program. Select the TULP2G.Profile.SIM-Investigation profile, and then click on Open.

Data extraction profiles of TULP2G

In the Case/Investigation Settings window, fill in the fields: Case Name, Investigator Name, and Investigation Name. This information will be used later in the preparation of the report by TULP2G.

The Case/Investigation Settings window

In the next window, TULP2G - SIM card; for the Communication Plug-in field, set the value as PC/SC chip card communication [1.4.0.3]. For the Protocol Plug-in field, set the value as SIM/USIM chip card data extraction [1.4.0.7]. If the examined SIM card has PIN or PUK code, enter it by clicking on the Configure button, which is located next to the Protocol Plug-in field.

Window TULP2G - SIM card.

Note

Reading data from the examined SIM card will not be possible if the PIN or PUK code are not entered.

Click on the Run button. The process of data extraction from the SIM card will begin. The progress of extraction can be seen in the progress bar.

The progress bar.

When the data is extracted from the SIM card, you can conduct a new extraction or generate a report about the extraction that has been performed. To generate the report, go to the Report tab. In the Report Name field, enter the name of the report; in the Export Plug-in and Selected Conversion Plug-in(s) fields, select plugins that will be used for the report generation. In the Selected Investigation(s) field, select those extractions for which you want to generate the report, and then click on Run.

The options window for the report generation

When the report generation process is finished, there will be two files with formats HTML and XML. The HTML file can be opened with any web browser.

A fragment of the report

These files contain information (a phonebook, text messages, calls, and so on) that was extracted from the examined SIM card. It can be viewed and analyzed.

How it works...

TULP2G extracts data from the SIM card that is installed in the card reader, which is connected to the expert's computer, and generates a report. During the verification process, MD5 and SHA1 hashes of the image and the source are being compared.

SIM card acquisition and analysis with MOBILedit Forensics

MOBILedit Forensic is a commercial forensic software by the company Compelson. It is updated regularly. This program can extract data from phones, smartphones, and SIM cards. As the program developers state, MOBILedit Forensic is a program that allows us to extract data from a phone or SIM card with a minimum number of steps. Also, this program has a unique function on which we will focus in another chapter.